Author
Topic: Sandisk Sansa View (Read 155561 times)

Well the Sansa View came out a short time ago, and good news: it's PortalPlayer based (Nvidia)! And it looks to use the same basic firmware/bootloader (rom+mi4) layout as the c200/e200.Use the latest version of mi4code to decrypt it with the key:70e19bda 0c69ea7d 2b8b1ad1 e9767ced (v 1.00.03)(found via mi4code keyscan on BootLoader.rom)Firmware is available for download from:http://forums.sandisk.com/sansa/board/message?board.id=view&thread.id=326Decryption works just fine, and there is a classic PPOS header in when the firmware is decoded. There appears to be a reference to the NVIDIA GoForce 6100 http://www.nvidia.com/page/goforce_6100.html, which features, among other things, a "Dedicated high performance 250MHz ARM1176JZ-S core"

Looks to be very close to the Sansa e200/c200 series in terms of the bootloader/firmware sections. So I would assume a properly made binary could be signed with the above key and executed on the player.

Player can be put in UMS/MSC mode via a startup hack:Let it boot up up, put the hold switch on. Hold down the left side of the scroll wheel and plug the usb cable in at the same time. Keep holding it until a drive appears. Can someone do an fdisk -l output?

Now, if someone with a View using 1.00.03 firmware could trying the decrypt/encrypt the firmware and see if it runs...

I've updated my mi4 page[1] to host the mi4+BL files for the View and I'm hosting MrH's most recent mi4code version[2] with built-in keys for the View... For your pleasure, I also host a copy of the View firmware zip[3].

A PP502x would be an odd thing to have if you're also got an ARM9 core too. Perhaps its purely 6100 based, and the 6100 is itself a new "PP" chip developed by Nvidia since their acquisition of the PP intellectual property.

A more detailed disassembly of the mi4 files should show whether its PP or not - i.e. if it's using the same registers.

EDIT: I've had a quick look at the disassembly of the firmware.mi4 file. There are lots of familiar PP registers being used (e.g. 0xf000f000 to remap memory, and checking 0x60000000 for 0x55 to test if the code is running on the CPU or COP). So it would seem to me that there's a PP chip in there.

Drkepilogue, is there a chip behind the metal shield in the first photo? If so, is it about the same size as the nvidia goforce 6100? If there's not, then the goforce 6100 is the SoC. From the link it is based on ARM1176JZ-S; could this be nvidia's development of PP?